ci: sync canonical pre-commit config (#11)

## Summary
- generate and ignore the canonical pre-commit config instead of
tracking a stale copy
- refresh it atomically on every make test
- install pre-commit and commit-msg hooks
- add full-tree Gitleaks scanning configuration

## Validation
- make test
- canonical pre-commit run --all-files

Author: xnoto

.gitignore

@@ -14,3 +14,7 @@
 
 # Plan output
 plan-output.txt
+
+# Generated pre-commit configuration
+/.pre-commit-config.yaml
+/.pre-commit-config.yaml.tmp

.gitleaks.toml

@@ -0,0 +1,6 @@
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Generated OpenTofu working data is ignored and never committed"
+paths = ['''(^|/)\.terraform(?:/.*)?$''']

.pre-commit-config.yaml

@@ -13,30 +13,34 @@ requested.
 
 ## Pre-commit Configuration
 
-Pre-commit configuration is **centralized** in `makeitworkcloud/images/tfroot-runner/pre-commit-config.yaml`. The CI workflow fetches this config at runtime.
-
-**Do not** create or modify `.pre-commit-config.yaml` in this repository.
+Pre-commit configuration is centralized at
+`https://raw.githubusercontent.com/makeitworkcloud/images/main/tfroot-runner/pre-commit-config.yaml`. The root
+`.pre-commit-config.yaml` is generated and ignored; do not edit it.
 
 For local development, run:
 ```bash
 make test
 ```
 
-This automatically fetches the canonical config if not present.
+This refreshes the generated config from the canonical source on every run and
+replaces it only when the content changed.
 
 ## CI/CD
 
 This repo uses the shared `opentofu.yml` workflow from `shared-workflows`. Jobs
 run natively on `arc-tf`; the runner pod already uses the `tfroot-runner` image,
-so the workflow does not start a nested container.
+so the workflow does not start a nested container. The shared workflow fetches
+the canonical pre-commit config at runtime; this repository does not provide a
+tracked copy.
 
 ### Failure Modes
 
 **"manifest unknown" error:** The `tfroot-runner:latest` image doesn't exist in GHCR. Check if the `images` repo Build workflow succeeded.
 
-**Pre-commit failures:** If hooks fail unexpectedly, the canonical config may have changed. Delete `.pre-commit-config.yaml` locally and re-run `make test` to fetch the latest.
+**Pre-commit failures:** If hooks fail unexpectedly, the canonical config may
+have changed. Re-run `make test` to refresh it and run the checks.
 
 ## Related Repositories
 
 - `images` - Contains tfroot-runner image and canonical pre-commit config
-- `shared-workflows` - Contains the reusable OpenTofu workflow and canonical pre-commit config
+- `shared-workflows` - Contains the reusable OpenTofu workflow

AGENTS.md

@@ -1,12 +1,12 @@
 SHELL         := /bin/bash
 TERRAFORM     := $(shell which tofu)
-S3_REGION     := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_region     | cut -d ' ' -f 2)
-S3_BUCKET     := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_bucket     | cut -d ' ' -f 2)
-S3_KEY        := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_key        | cut -d ' ' -f 2)
-S3_ACCESS_KEY := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_access_key | cut -d ' ' -f 2)
-S3_SECRET_KEY := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_secret_key | cut -d ' ' -f 2)
+S3_REGION     = $(shell sops decrypt secrets/secrets.yaml | grep ^s3_region     | cut -d ' ' -f 2)
+S3_BUCKET     = $(shell sops decrypt secrets/secrets.yaml | grep ^s3_bucket     | cut -d ' ' -f 2)
+S3_KEY        = $(shell sops decrypt secrets/secrets.yaml | grep ^s3_key        | cut -d ' ' -f 2)
+S3_ACCESS_KEY = $(shell sops decrypt secrets/secrets.yaml | grep ^s3_access_key | cut -d ' ' -f 2)
+S3_SECRET_KEY = $(shell sops decrypt secrets/secrets.yaml | grep ^s3_secret_key | cut -d ' ' -f 2)
 
-.PHONY: help init plan apply migrate test pre-commit-check-deps pre-commit-install-hooks argcd-login
+.PHONY: help init plan apply migrate test pre-commit-config pre-commit-check-deps pre-commit-install-hooks argcd-login
 
 help:
 	@echo "General targets"
@@ -55,12 +55,18 @@ migrate:
 	@echo "First use -make init- using the old S3 backend, then run -make migrate- to use the new one."
 	@${TERRAFORM} init -migrate-state -backend-config="key=${S3_KEY}" -backend-config="bucket=${S3_BUCKET}" -backend-config="region=${S3_REGION}" -backend-config="access_key=${S3_ACCESS_KEY}" -backend-config="secret_key=${S3_SECRET_KEY}"
 
-test: .pre-commit-config.yaml .git/hooks/pre-commit
+test: pre-commit-config pre-commit-install-hooks
 	@pre-commit run -a
 
-.pre-commit-config.yaml:
-	@curl -sSL -o .pre-commit-config.yaml \
+pre-commit-config:
+	@curl --fail --silent --show-error --location \
+		--output .pre-commit-config.yaml.tmp \
 		https://raw.githubusercontent.com/makeitworkcloud/images/main/tfroot-runner/pre-commit-config.yaml
+	@if cmp -s .pre-commit-config.yaml.tmp .pre-commit-config.yaml; then \
+		rm -f .pre-commit-config.yaml.tmp; \
+	else \
+		mv .pre-commit-config.yaml.tmp .pre-commit-config.yaml; \
+	fi
 
 DEPS_PRE_COMMIT=$(shell which pre-commit || echo "pre-commit not found")
 DEPS_TERRAFORM_DOCS=$(shell which terraform-docs || echo "terraform-docs not found")
@@ -76,7 +82,5 @@ pre-commit-check-deps:
 	@echo "  jq: ${DEPS_JQ}"
 	@echo ""
 
-pre-commit-install-hooks: .git/hooks/pre-commit
-
-.git/hooks/pre-commit: pre-commit-check-deps
-	@pre-commit install --install-hooks
+pre-commit-install-hooks: pre-commit-config pre-commit-check-deps
+	@pre-commit install --install-hooks --hook-type pre-commit --hook-type commit-msg